The Australian Communications and Media Authority imposed a $2 million penalty on food‑delivery platform DoorDash after finding the company breached the nation’s spam regulations.
Regulator’s findings and the fine
According to the ACMA, between February and October 2022 DoorDash sent more than 566,000 promotional emails to recipients who had previously unsubscribed.
The authority also cited over 515,000 text messages sent to prospective drivers that lacked a functional unsubscribe option.
DoorDash, a US‑based firm operating across all Australian states and territories, serves roughly 30,000 local businesses and reaches more than 80 % of the population.
The regulator said the conduct violated the Spam Act 2003, which governs commercial electronic messaging.
Under the law, senders must have consent, clearly identify themselves, and provide a working way for recipients to opt out.
What the Spam Act requires
The legislation sets a framework for email, SMS and other digital messages that promote goods or services.
Key obligations include obtaining prior consent, disclosing the sender’s identity, and ensuring an unsubscribe link or mechanism functions correctly.
Companies are also prohibited from using address‑harvesting software or lists derived from such tools.
Related: Land Tax Exemption for Trusts Uncertain
Failure to comply can lead to civil penalties, injunctions or other enforcement actions.
In DoorDash’s case, the ACMA concluded the company mischaracterised its messages as “solely factual,” despite containing offers and incentives aimed at customers and drivers.
This mischaracterisation meant the messages fell within the scope of the Act, triggering the $2 million infringement penalty.
Company response and next steps
DoorDash argued that its communications were factual and therefore exempt from the spam rules.
However, the regulator noted that any message containing promotional elements, such as discounts or driver incentives, is subject to the same requirements.
The fine represents one of the larger penalties issued under the Act in recent years, signaling a stricter enforcement stance.
DoorDash has not disclosed a detailed plan for addressing the breach, but the regulator expects the firm to adjust its marketing practices to meet legal standards.
In practice, the company will need to audit its contact lists, verify consent records, and implement reliable unsubscribe mechanisms across all channels.
For gig‑workers, this could mean clearer communication about job offers and an easier way to stop receiving unsolicited messages.
Related: Australia Updates Family Visa Processing Rules
Customers may also notice fewer unwanted emails, as the company will have to respect opt‑out requests more rigorously.
The fine may prompt other platform operators to review their outreach strategies, especially those relying heavily on digital promotions.
It highlights the importance of compliance teams staying current with local regulations, even for global businesses.
In the broader context, the penalty shows the regulator’s willingness to pursue large‑scale infractions, not just isolated incidents.
DoorDash’s experience serves as a reminder that promotional efficiency must be balanced against legal responsibilities.
In short, the company will have to rebuild parts of its marketing infrastructure to avoid future breaches.
Overall, the case illustrates how data‑driven outreach can run afoul of laws when consent and opt‑out processes are overlooked.
While the $2 million figure may seem sizable, the larger cost could be the operational changes required to bring the program into compliance.
For now, the ACMA’s action stands as a clear signal to the industry: respect the rules or face significant penalties.
Leave a Reply